https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/533944#M7361 <P>Can we use one channel identifier for multiple clients through Splunk HEC to enable indexer acknowledgement</P> Wed, 23 Dec 2020 12:23:27 GMT Durgapk 2020-12-23T12:23:27Z https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/360197#M7356 <P>Quote from <A href="http://dev.splunk.com/view/event-collector/SP-CAAAE8X#aboutchannels">event collector docs</A>:</P> <BLOCKQUOTE> <P>Channels are designed so that you assign a unique channel to each client that sends data to HEC. Each channel has a channel identifier (ID), which must be a GUID but can be randomly generated. You assign channel IDs simply by including them in requests as shown in the examples above. When the Splunk server sees a new channel identifier, it creates a new channel.</P> </BLOCKQUOTE> <P>What does this mean, exactly? If I have four different pieces of software, e.g. a Linux client program and a Windows client program, each of which log to Splunk, how many channel identifiers should I generate? The word “client” is quite ambiguous here...</P> <UL> <LI>One per client software, Linux and Windows?</LI> <LI>One per released version of the softwares?</LI> <LI>One per actual client running the software?</LI> </UL> <P>Does the channel parameter actually impact indexing or queries in any way? I don't understand why it's required at all.</P> Wed, 09 Aug 2017 12:35:16 GMT https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/360197#M7356 mneergaa 2017-08-09T12:35:16Z https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/360198#M7357 <P>According to what I understand, it means the third meaning you mentioned, "one per actual client running the software". I think this is only needed if you use the indexer acknowledge, and you can read more details from here:<BR /> <A href="http://dev.splunk.com/view/event-collector/SP-CAAAE8X#aboutchannels">http://dev.splunk.com/view/event-collector/SP-CAAAE8X#aboutchannels</A></P> Sun, 29 Apr 2018 08:54:10 GMT https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/360198#M7357 sni_splunk 2018-04-29T08:54:10Z https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/360199#M7358 <P>The new links are below.</P> <OL> <LI><A href="https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/FormateventsforHTTPEventCollector#Channel_identifier_header">https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/FormateventsforHTTPEventCollector#Channel_identifier_header</A></LI> <LI><A href="https://docs.splunk.com/Documentation/Splunk/7.1.2/RESTREF/RESTinput#services.2Fcollector.2Fraw">https://docs.splunk.com/Documentation/Splunk/7.1.2/RESTREF/RESTinput#services.2Fcollector.2Fraw</A></LI> </OL> <P>Be sure to select your Splunk version from that page (see URL).</P> Tue, 12 May 2020 23:50:05 GMT https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/360199#M7358 shandr 2020-05-12T23:50:05Z https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/533942#M7359 <P>Can we use one channel identifier for multiple clients through Splunk HEC to enable indexer acknowledgement</P> Wed, 23 Dec 2020 12:15:03 GMT https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/533942#M7359 Durgapk 2020-12-23T12:15:03Z https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/533943#M7360 <P>Can we use one channel identifier for multiple clients through Splunk HEC to enable indexer acknowledgement</P> Wed, 23 Dec 2020 12:16:01 GMT https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/533943#M7360 Durgapk 2020-12-23T12:16:01Z https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/533944#M7361 <P>Can we use one channel identifier for multiple clients through Splunk HEC to enable indexer acknowledgement</P> Wed, 23 Dec 2020 12:23:27 GMT https://community.splunk.com/t5/Splunk-Enterprise/HTTP-event-collector-Channel-identifiers-what-do-they-identify/m-p/533944#M7361 Durgapk 2020-12-23T12:23:27Z